Privacy Policy

1. Who we are

Peritale is a general wellness product made by MARKABLE Ltd. (“we”, “us”), an Israeli company, company number 517096632, of 93A Kibbutz Galuyot St., Herzliya, Israel. Privacy questions: privacy@peritale.online. We decide how and why your personal data is used, which makes us the controller of it. It is not a medical device. Its results are for your own awareness and for talking with your doctor, and any medical question belongs with your doctor.

• Company: MARKABLE Ltd., Israel.
• Privacy contact: privacy@peritale.online.
• Where it is open: the Peritale mapping in the app is open to people in Israel only at the moment. This website can be read from anywhere. The sections for other regions describe the rights that apply to you there, and they apply if you use Peritale from there.

This policy covers peritale.online and the Peritale app at app.peritale.online. Each region has its own section further down. They add to this text and never take rights away.

2. What we collect, why, who sees it and for how long

Here is the full picture: what we collect, why, who sees it, how long we keep it and what you can choose.

We may also collect small amounts of data you give us in other places, such as a message in the chat or a form. Where we collect something not listed here, we tell you at that moment.

3. Your selfie, photos and voice

This part matters most, so we are specific.

• What happens: in the app you take a still selfie. The app uploads the original and a smaller copy to our storage in Google Cloud. We send the photo to two outside image-analysis companies, Perfect Corp and AILab. They return measurements of your face and skin and images that mark where each was found, and we show them in your mapping. We also keep the result package from Perfect Corp in our Google Cloud storage in the United States.
• Your voice: only if you use daily check-ins, the app records your spoken answer and sends it to Google (Gemini) to be turned into text. The audio stays in our storage until you delete that check-in.
• Not for recognition: we do not use your face or voice to identify you, to sign you in, or to match you with anyone else’s images.
• Consent: before the camera opens, the app asks you to tick a consent box. Some laws treat measurements of face geometry as biometric data even when nobody is being identified. This policy and the biometric notice below therefore describe your selfie as biometric data, in every region.
• Storage: your selfie images are stored with Google’s standard encryption, and are kept until you ask us to delete them. Nothing deletes them automatically today.
• Never sold: we never sell your face or voice data, and we never give it to anyone for their own purposes. Our analysis providers receive your selfie so that they can analyse it for us. We use them under their standard terms.
• Your control: you can withdraw your consent and ask us to delete your images and data at any time. Write to privacy@peritale.online, or use the deletion-request form in the app. Say that you want your images deleted, because deleting an account or scan in our system does not remove the image files by itself today (see “How long we keep data”).

4. How we use your data

We use your health information to run Peritale: to build your mapping, set your baseline, show your progress and prepare your report. If you tick the optional research box, we also use it for research, as described below. We do not sell it and we do not use it for advertising.

We use your information to:

• build your personal mapping and your baseline;
• track how your picture changes when you map again;
• prepare the report you can take to your doctor;
• send you your results, your receipts and, if you ask for them, updates;
• answer your questions and keep the service secure;
• meet our legal duties.

We do not sell your data, build advertising profiles from it, or use it to recognise your face.

5. AI and automated analysis

We use AI and outside image-analysis services to analyse your selfie and your check-in answers and to turn them into measurements, markers and scores.

• Your results are information for you and your doctor. They are not a medical conclusion, and the analysis can be wrong. Talk to your doctor before you act on a result.
• We make no decision about you with legal or similarly significant effect by automated means alone. If you would like a person on our team to look at a result, write to us and we will.
• We do not use your personal data to train general-purpose large language models. We use Perfect Corp, AILab and Google (Gemini) under their standard terms.
• If you tick the research box (next section), we may use your scan data to develop and test our own analysis methods, which can include machine-learning models of our own.

6. Optional: research and product improvement

This is a separate, optional box in the app. Whether you tick it changes nothing about your mapping or your report.

• If you do not tick it: we do not select your data for research. Your selfie is still sent to the analysis providers to build your mapping, as described above, and it is kept as described above.
• If you tick it: we may include your selfie, the measurements from it and your answers in research exports that our team downloads and analyses on its own computers and file storage. A face photo can still identify you, so we treat research copies as personal data and protect them as such. We use them to develop and test our own analysis methods. We may publish findings, only as grouped results that do not identify anyone.
• Withdrawing: write to us at any time. We stop using your data for research and delete your research copy. If a model has already been trained with your data, its training cannot be undone, and we will not use your data for any further training.

7. Who sees your data

We do not sell your data and we do not use it for advertising. Providers process data for us and for the purposes in this policy. We use them under their standard terms.

Beyond providers, your data goes only to:

• People you choose: a doctor or clinic, when you choose to share your report with them.
• Authorities: where the law requires it, on a valid legal request.
• A buyer or partner of our business: if MARKABLE merges or is sold, your data would go to the new owner under this same policy, and we would tell you first.

Session-recording tools in the app: if you accept analytics in the app, FullStory and Heap may record how you use the screens, and that can include screens where you enter or see health information. If you reject analytics, they do not load. We do not use advertising tools on any screen.

8. Sharing your report with your doctor

Your report is yours. We prepare it for you to read, print and take to your doctor.

• A doctor or clinic can see your results and report if you connect them to your account in the app, or if you started Peritale from that doctor’s or clinic’s link. The app records your choice.
• Once a doctor or clinic has your report, their own privacy rules apply to their copy.
• You can ask us to stop the sharing at any time by writing to us. Access we gave stops; a copy already received cannot be taken back.

9. Cookies, analytics and page loading

This website. Nothing for analytics loads until you press Accept on the cookie banner. If your browser sends a Global Privacy Control signal, we treat it as a refusal. You can change your choice at any time with the Cookie settings control, which clears the cookies and reloads the page. Your choice is saved in your own browser and not on our servers.

• Essential: remember your cookie choice. They set no analytics.
• Google Analytics 4 (G-9GKG02ZL9Z): counts, in grouped form, how the site is used. Loads only after you accept. You can also use Google’s opt-out tool.
• Microsoft Clarity: grouped session insights and heatmaps to improve the site. Loads only after you accept. See Microsoft’s privacy statement.
• Visitor counter: a small counter we run ourselves records the page and your country for daily counts, and only after you accept.

The app. The app at app.peritale.online has its own cookie banner. FullStory (session recording) and Heap (usage analytics) load only after you accept, and do not load if you reject. Google Tag Manager loads when the app opens, so Google receives your IP address and browser type before you choose, and the Google tags in it are set to follow Google’s consent mode.

Fonts: when a website page loads, your browser contacts Google Fonts, which sees your IP address and browser type, whatever you choose in the banner.

We do not use advertising cookies, retargeting pixels or social-media tracking pixels. More detail is in our Cookie Policy.

10. Where your data is processed

We are based in Israel, which the European Commission recognises as providing adequate protection for personal data (Decision 2011/61/EU). Our providers store and process data in the United States, Europe and other places, and the image-analysis companies and the sign-in provider work outside Israel. The Cloudflare network runs worldwide. Where a provider’s standard terms include transfer safeguards, those apply today. You can write to us to ask what applies to your data. Where personal data is transferred outside Singapore, the safeguards stated in this section are the ones in place today; we have not yet put contractual safeguards in place with every provider.

11. How long we keep data

This is our retention and destruction schedule, including for selfie images. We have no automatic deletion for selfie images or results yet, so the practical rule is: your data stays until you ask us to delete it.

A deletion request currently removes your records from our database. It does not remove the image files in our cloud storage by itself, and it does not reach copies held by our providers. If you ask us to delete your images, we delete the files by hand and ask our providers to remove their copies. Aggregated results that no longer identify anyone may stay.

12. Security

• Encryption in transit (TLS) and at rest, using our providers’ standard encryption.
• Access limited to the small team that needs it.

If something goes wrong that affects your data, we tell you and the regulators as the law requires. That includes unauthorised disclosure, not only hacking. No system is completely secure, so we cannot promise perfect security.

13. Age: 18 and over

Peritale is for people aged 18 and over. Please do not use it if you are younger. If we learn that someone under 18 has used Peritale, we delete their data. We do not run advertising to under-18s.

14. Your rights and how to use them

Depending on where you live, you can ask us to: tell you what we hold about you and give you a copy; correct it; delete it; give it to you in a portable format; stop or limit certain uses; and withdraw a consent you gave. You can also ask how a score about you was worked out. The section for your region lists the rights your law gives you.

• How: write to privacy@peritale.online, or use the deletion-request form in the app. To delete your images, say so in your request.
• Checking it is you: we may ask for something that shows the request comes from you. We ask for as little as we can.
• When: we answer within 30 days. Where the law allows us more time and we need it, we tell you why.
• Cost: free. If we refuse, we tell you why.
• Someone acting for you: an authorised agent may write on your behalf with your written permission.

We will not treat you worse for using your rights. If you are not satisfied, you can contact the Personal Data Protection Commission (see the section on your rights under the PDPA).

15. Your rights under the PDPA

The PDPA gives you a clear set of protections. In plain terms, we will:

• Seek your consent before collecting, using, or disclosing your personal data, and let you withdraw it.
• Tell you the purpose (the Notification and Purpose Limitation obligations) and use your data only for those purposes.
• Give you access to the personal data we hold about you and how it has been used, and correct it on request.
• Protect your data with reasonable security arrangements.
• Retention: the Retention Limitation obligation applies to us. Today we have no automatic deletion for selfie images and results; your data stays until you ask us to delete it (see “How long we keep data”).
• Notify you and the Personal Data Protection Commission (PDPC) of a notifiable data breach.

You may lodge a complaint with the PDPC at pdpc.gov.sg if you believe we have not met these obligations.

16. Consent and how to withdraw it

We rely on your consent to collect, use, and disclose your personal data for the purposes above. You may withdraw consent for any purpose at any time by emailing privacy@peritale.online. We will tell you the likely consequences of withdrawal (for example, that we can no longer generate or track your wellness picture), and we will stop the relevant processing within a reasonable time.

17. Access and correction

Under the PDPA you may ask us for access to the personal data we hold about you and information on how it has been used or disclosed in the past year, and you may ask us to correct any error or omission. To make a request, email privacy@peritale.online. We will respond as soon as reasonably possible, and where we cannot do so within 30 days we will tell you when to expect a response.

18. Data breach notification

If a data breach occurs that is likely to result in significant harm to you, or is of a significant scale (500 or more people), we will assess it and, once we determine it is notifiable, notify the Personal Data Protection Commission as soon as practicable and no later than 3 calendar days after that, and the affected individuals, in accordance with the PDPA's data breach notification requirements.

19. Marketing and Do Not Call

We will only send you marketing or wellness messages where you have opted in, and you can opt out at any time using the link in the message or by emailing us. If you provide a Singapore telephone number and we ever contact you by telephone, SMS, or fax for marketing, we will comply with the Do Not Call (DNC) provisions of the PDPA and check the relevant DNC registers before doing so.

20. Changes to this policy

We may update this policy. For a significant change we post a notice on the site and in the app, and the date at the top shows the latest version. If a change needs your consent, we ask for it again.

21. Contact us

• Privacy questions and requests: privacy@peritale.online
• General contact: hello@peritale.online

Controller: MARKABLE Ltd., Israel.